Overview
HouzRent ("we", "us", "our") is a Nigerian rental management platform operated by Hustle 360 Ltd. We are committed to protecting the privacy of landlords, tenants, and all users of our platform.
This Privacy Policy explains what personal data we collect when you use HouzRent, why we collect it, how we use it, and what rights you have. It applies to our website, mobile application, and all services we provide.
🔒 Key commitment: Your NIN (National Identification Number) is never stored in plain text. It is immediately hashed using HMAC-SHA256 upon submission and only the hash is retained. Not even HouzRent staff can view your NIN.
By using HouzRent, you consent to the collection and use of your information as described in this policy. If you disagree with any part of this policy, please discontinue use of our services.
Information We Collect
Account Information
When you register on HouzRent, we collect:
- Full name (first and last name as provided during NIN verification)
- Email address
- Phone number
- Password (stored as a bcrypt hash — never in plain text)
- Account role (landlord or tenant)
Identity Verification Data
To verify your identity, we collect:
- NIN (National Identification Number) — immediately hashed, never stored in plain text
- Last 4 digits of your NIN (for display purposes only)
- Verification status and timestamp
- Data returned by NIMC via our identity verification provider (iCheck): name, date of birth, gender, nationality, phone number
Tenancy & Property Data
- Property addresses, type, size, and rental amount
- Lease agreement content and digital signature details (signatory name, IP address, timestamp)
- Tenancy dates, payment frequency, and agreement references
Payment & Wallet Data
- Wallet transaction history (top-ups, rent payments, withdrawals)
- Payment references and amounts
- Bank account details provided for withdrawals
- Flutterwave transaction IDs (we do not store card numbers)
Technical Data
- IP address (collected at lease signing for legal record)
- Browser type and device information
- Login timestamps and session data
- Application logs for debugging and security monitoring
How We Use Your Information
| Purpose | Data Used | Basis |
|---|---|---|
| Create and manage your account | Name, email, phone, password hash | Contract |
| Verify your identity (NIN) | NIN hash, NIMC-returned data | Legal obligation / Contract |
| Process rent payments and wallet transactions | Wallet data, payment references | Contract |
| Generate and store digital lease agreements | Tenancy data, IP address, name | Contract / Legal obligation |
| Send rent reminders and lease expiry alerts | Email, tenancy dates | Legitimate interest / Contract |
| Manage deposit escrow and dispute resolution | Tenancy data, payment history | Contract |
| Push address records to iCheck NIN registry | NIN hash, property address, tenancy dates | Consent / Legitimate interest |
| Fraud prevention and security monitoring | IP address, login data, transaction patterns | Legitimate interest |
| Customer support | Account data, transaction history | Contract |
We do not use your data for advertising purposes and do not sell your personal information to third parties.
NIN & Identity Data
Given the sensitive nature of National Identification Numbers, we apply additional protections:
- Immediate hashing: Your NIN is hashed using HMAC-SHA256 with a secret key the moment it is submitted. The plain NIN is never written to our database.
- Hash-only storage: We store only the hash and the last 4 digits of your NIN. The hash cannot be reversed to reveal your original NIN.
- iCheck verification: NIN verification is performed via iCheck, which interfaces with Nigeria's NIMC. iCheck has its own data protection practices.
- Address registry: When your tenancy is activated, your verified rental address is pushed to the iCheck NIN registry. This builds your verifiable rental history and is disclosed to you at registration.
- Staff access: No HouzRent staff member can view your full NIN or reverse the hash.
Wallet & Payments
HouzRent operates an internal wallet system for processing rent payments. Key points:
- Card details are never stored on HouzRent systems. All card processing is handled exclusively by Flutterwave.
- Wallet balances and transaction history are stored securely in our database.
- Bank account details provided for withdrawals are encrypted at rest.
- All payment transactions are logged with timestamps and references for audit purposes.
- Deposit escrow amounts are tracked separately and can only be released through the platform's dispute resolution process.
Data Retention
We retain your personal data for as long as your account is active or as needed to provide our services. Specifically:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 2 years after closure |
| NIN hash | Duration of account + 7 years (legal requirement) |
| Lease agreements | 7 years from lease end date |
| Payment records | 7 years (FIRS compliance) |
| Application logs | 90 days |
| Email OTPs | Deleted after use or expiry (10 minutes) |
You may request deletion of your account and personal data at any time. Please note that we may be required to retain certain data (such as financial records) for compliance purposes even after account deletion.
Your Rights
Under applicable Nigerian data protection law (NDPR), you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data (subject to legal retention requirements)
- Right to data portability — receive your data in a portable format
- Right to object — object to processing based on legitimate interest
- Right to restrict processing — request restriction of how we use your data
- Right to withdraw consent — where processing is based on consent
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
Security
We implement industry-standard security measures to protect your data:
- All data in transit is encrypted using TLS 1.2+
- Database encryption at rest via Digital Ocean managed database services
- Passwords stored using bcrypt hashing
- NIN stored as HMAC-SHA256 hash only
- Regular security reviews and vulnerability assessments
- Access controls limiting staff access to personal data on a need-to-know basis
- Two-factor authentication available for all accounts
Despite these measures, no system is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected].
Contact Us
If you have any questions about this Privacy Policy or how we handle your personal data, please contact us:
HouzRent Privacy Team
Email: [email protected]
For urgent security matters: [email protected]
We aim to respond to all privacy requests within 30 days.